RE: Virus alert

["Dan Mauch" <dmauch-at-seanet.com>]

I found out that the virus name is w32/ska-at-m
It creates a file call ska.exe in the windows/system directory
To remove it you must GO TO THE START BUTTOON AND SELECT shutdown and
select restart in MSDOS mode  to remove it do the following:
Type
CD c:\WINDOWS\SYSTEM
REN WSOCK32.DLL WSOCK32.BAD
REN WSOCK32.SKA WSOCK32.DLL
DEL SKA.EXE
COPY LISTE.SKA C:\


DAN

-----Original Message-----
From: emc-at-nist.gov [emc-at-nist.gov] On Behalf Of Ron Wickersham
Sent: Tuesday, July 24, 2001 1:23 PM
To: Multiple recipients of list
Subject: RE: Virus alert


i heard it on the radio here in northern Calif as some replicating virus
that had put as many as 2000 mails in one person's inbox.  they reported
it was actually two virii and the efect of the other had not been
reported.
the actual text of the message agreed with what the radio reported.  

i didn't pay much attention since i use pine as my mail agent running
on Sun so it wouldn't affect me anyway.  but i did examine the
attachments
sent by the mailing list program and the evil stuff had been removed.

-ron

On Tue, 24 Jul 2001, Dan Mauch wrote:

> What virus is it?. I opened from another source by since it was  a
.TXT
> file I didn't think it could hurt  because it said it was a AT0005.txt
> file.
> So far I haven't seen any effects from it but have been trying to
locate
> a fix for it in case. My older virus scanning program thought this
file
> was fine.
> Dan
> 
> 
> -----Original Message-----
> From: emc-at-nist.gov [emc-at-nist.gov] On Behalf Of Ron Wickersham
> Sent: Tuesday, July 24, 2001 10:16 AM
> To: Multiple recipients of list
> Subject: Re: Virus alert
> 
> 
> yes the message was intended as a virus.
> 
> but the mailing list software at nist removed the attachment
> automatically
> so the message is safe.
> 
> -ron wickersham
> 
> On Tue, 24 Jul 2001, Rubio, Angel wrote:
> 
> > I think that the last message is a virus. I have not opened but I
> think it
> > is.
> > 
> > 
> > 
> 
> 
> 
> 
>